Phase A-E: stability, security, observability, and test coverage

Phase A - Stability:
- Engine.Start(): recovers orphaned jobs (running/queued/waking_up) after crash
- Engine.Stop(): graceful shutdown - cancels all in-flight jobs and waits
- Queue keyed by jobID (not syncPairID): cancel now targets exact job
- Local rsync uses jobCtx (context.Background() replaced)
- Migrations wrapped in transactions; checksums stored

Phase B - Security:
- admin/admin default removed: SYNCSERVER_ADMIN_PASSWORD required on first run
- Path validation: rejects .., leading -, null bytes in sync pair paths
- Rsync flags allowlist: dangerous flags blocked (--rsync-path, -e, --files-from)
- Shell concat in RunRemote replaced with proper sh -c escaping
- knownhosts: replaced custom parser with golang.org/x/crypto/ssh/knownhosts
- RequireAdmin wired: machine CRUD, SSH key ops, settings require admin role
- deploy-keys: uses authorized_keys only (no private key upload)
- Hardcoded /var/lib/syncserver/ssh paths replaced with cfg.SSHDir()

Phase C - Operational:
- /readyz health check: DB query + SSH dir accessibility
- /metrics endpoint: Prometheus text format (jobs, queue, machines)
- Event struct JSON tags: job_id, machine_id, type (snake_case)
- EventBus broadcast: fanned out to all subscribers
- SQLite VACUUM INTO backup: scheduled before cleanup if BackupDir set
- Filesystem job log cleanup: removes .log files for purged jobs
- Backup retention: old backups auto-purged

Phase D - Frontend:
- Schedules page: REST API + full CRUD UI for cron schedules
- Dashboard: cancel button for running/queued jobs
- JobDetail: server-side log download via API
- Settings: displays data_dir from server
- 404 page: proper NotFound component

Phase E - Tests:
- auth_test.go: JWT, bcrypt, middleware, seed (18 tests)
- models_test.go: Job, Machine, SyncPair, Schedule repos (18 tests)
- go test -race: no data races found

internal/syncengine/parser.go

@@ -16,21 +16,21 @@ type RsyncStats struct {
 }
 
 type ProgressLine struct {
-	Phase    string
-	Percent  float64
-	Files    int
-	Total    int
-	SentBytes int64
+	Phase       string
+	Percent     float64
+	Files       int
+	Total       int
+	SentBytes   int64
 	XferedBytes int64
 }
 
 type ProgressFields struct {
-	FileBytes     int64
-	Pct          int
-	SpeedBps     int64
-	EtaSeconds   int
-	XfrDone      int
-	XfrTotal     int
+	FileBytes  int64 `json:"file_bytes"`
+	Pct        int   `json:"pct"`
+	SpeedBps   int64 `json:"speed_bps"`
+	EtaSeconds int   `json:"eta_seconds"`
+	XfrDone    int   `json:"xfr_done"`
+	XfrTotal   int   `json:"xfr_total"`
 }
 
 var (
@@ -138,9 +138,9 @@ func parseProgressFields(line string) *ProgressFields {
 	}
 
 	pf := &ProgressFields{
-		FileBytes: bytes,
-		Pct:      pct,
-		SpeedBps: speedBps,
+		FileBytes:  bytes,
+		Pct:        pct,
+		SpeedBps:   speedBps,
 		EtaSeconds: etaSecs,
 	}